Putting confidential or commercial information into ChatGPT, Claude, Gemini or Copilot is enormously useful — for summarising, extracting and rewriting text. It’s also a live question for every CIO: where does that data go, and could it end up training a model, or leaking?

The short answer: it depends entirely on account type and one setting. Consumer/free accounts are increasingly trained on by default; paid business and enterprise tiers exclude your data by contract. The checklist below is the fix — five minutes, once per person, and worth repeating whenever a vendor quietly flips the default, as GitHub did with Copilot in April 2026 and Anthropic did with Claude in September 2025.

Privacy sweep checklist — 2 July 2026

• ☐ ChatGPT — Profile icon → Settings → Data Controls → turn off “Improve the model for everyone”. Logged-out chats are trained on by default too, so always sign in first.
• ☐ Claude — Settings → Privacy → turn off “Help improve Claude” (claude.ai/settings/data-privacy-controls). Check this even if you set it before: Anthropic switched consumer accounts to train-by-default in September 2025, with 5-year retention for anyone who doesn’t opt out (versus 30 days for those who do).
• ☐ Google Gemini — myactivity.google.com/product/gemini → turn off “Keep Activity” (renamed from “Gemini Apps Activity”). Even switched off, Google still holds your chats for 72 hours to run the service.
• ☐ Microsoft Copilot (personal account) — Profile icon → Settings → Privacy → turn off both “Training on conversation activity” and “Training on voice conversations”.
• ☐ GitHub Copilot — Settings → Copilot → Privacy → turn off “Allow GitHub to use my data for AI model training”. This one matters right now: as of 24 April 2026, GitHub switched Free/Pro/Pro+/Max individual accounts to train-by-default — if you checked this before that date, go back and recheck it.

The real upgrade

Toggles get reset, renamed and quietly flipped back on. For anything regulated or genuinely sensitive, move it off consumer tiers entirely and onto a Business/Team/Enterprise plan — those exclude your data from training by contract, not by a setting someone has to remember to check.

Re-run this checklist at least twice a year: every vendor above has changed its default at least once in the past twelve months.